The vulnerability resides in the TransactionController of the Mohammed-eid35 bank-management-system-springboot application. An attacker can bypass authorization controls when interacting with the transaction endpoint, leading to unauthorized exposure or manipulation of transaction data. This flaw aligns with the weaknesses of CWE‑266 and CWE‑285, indicating that the system fails to enforce proper privilege checks and authorizations.

The affected product is Mohammed‑eid35 bank‑management‑system‑springboot. No specific release numbers are available because the project uses rolling releases, but the vulnerability applies to any commit prior to the missing patch (up to commit 7b9bcc65ad7df3db29af71aed9bb500e5f24d948).

The CVSS base score of 5.3 classifies the issue as medium severity. The Exploit Prediction Scoring System (EPSS) score is not available, so current exploitation likelihood cannot be quantified. The vulnerability is publicly disclosed and can be triggered remotely through the transaction endpoint. However, the project's maintainers have not yet released a fix, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited exploitation activity to date.